CVE-2025-9784: Undertow: undertow madeyoureset http/2 ddos vulnerability
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Other sources
HTTP/2 (including DNS over HTTPS) contains a design flaw and is vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9784?
CVE-2025-9784 has been classified as a high severity vulnerability due to its potential to cause excessive workload on affected servers.
How do I fix CVE-2025-9784?
To mitigate CVE-2025-9784, users should upgrade to a version of Undertow beyond 2.3.18.Final where the vulnerability has been addressed.
What types of software are affected by CVE-2025-9784?
CVE-2025-9784 affects Undertow and several Red Hat products including JBoss and Fuse versions that incorporate Undertow.
What is the 'MadeYouReset' attack associated with CVE-2025-9784?
The 'MadeYouReset' attack is a method where malformed client requests can cause server-side stream resets without triggering normal abuse countermeasures.
Is CVE-2025-9784 related to HTTP/2?
Yes, CVE-2025-9784 involves flaws in the handling of HTTP/2 requests by Undertow, which allows for the abuse of server resources.